1. Field of the Invention
The invention relates to status monitors, including those for adaptively monitoring status information from multiple sources such as file servers and system administrators.
2. Related Art
Monitoring devices collect and present monitoring information, such as information regarding operation of a device, system, or network. The monitoring information is sometimes used to determine or respond to faults in the monitored devices, systems, or networks.
One problem in the known art is that of recognizing and responding to anomalous behavior on the part of the monitored devices, systems, or networks. Because the monitored devices, systems, or networks can be complex, it is difficult or impossible to anticipate all, or even most, of the possible ways in which anomalous behavior can occur. Even if it were possible to anticipate anomalous behaviors, it is difficult or impossible to anticipate how those anomalous behaviors would manifest themselves in the available data.
A first known method is to present a visual display of status information, and to rely on a human operator to determine whether the behavior of the monitored devices, systems, or networks are anomalous, and if so, to determine what that anomalous behavior indicates about possible errors or faults in operation. While this method can achieve the purpose of recognizing and responding to anomalous behaviors, it has the drawback of requiring constant and consistent attention of a human being relatively skilled in the operation of the monitored devices, systems, or networks. This drawback is exacerbated when there are a relatively large number of monitored devices, systems or networks or when the monitored devices, systems or networks are complex. Moreover, this known method is also subject to the drawback that it is limited to those aspects of behavior that are predetermined for presentation to the human being.
A second known method is to present information, as in the first method, to an expert system or other software designed for recognizing and responding to anomalous behavior. While this known method has the advantage of not requiring the constant and consistent attention of a human being, it suffers from the drawback that it is limited by the skill predetermined for inclusion in the expert system or other software. As with the first known method, this method is also subject to the drawback that it is limited to those aspects of behavior that are predetermined for presentation (to the expert system). Moreover, this method is also subject to the drawback that it can erroneously determine and respond to anomalous conditions that are not in fact faults, without substantial opportunity to learn.
Accordingly, it would be desirable to provide a method and system for monitoring status in a relatively continuous, consistent, and intelligent manner. This method is achieved in an embodiment of the invention in which a status monitor receives monitoring data, adaptively and dynamically builds a database of known combinations of monitoring data, and adaptively and dynamically associates those known combinations with assessments of the monitored devices, systems, or networks. From an initial set of selected knowledge that is limited (even limited to no knowledge at all), the status monitor can learn those anomalous conditions that require response and what responses are appropriate.
The invention provides a method and system for monitoring status in a relatively continuous, consistent, and intelligent manner. A status monitor receives monitoring data, adaptively and dynamically builds a database of known combinations of monitoring data, and adaptively and dynamically associates those known combinations with assessments of the monitored devices, systems, or networks. From an initial set of selected knowledge that is limited (even limited to no knowledge at all), the status monitor learns those anomalous conditions that require response and what responses are appropriate. The status monitor develops a database of information regarding distinguishable conditions, and measurements of the likely causes or effects of recognizable errors or faults. When an anomalous pattern is recognized, the status monitor, responsive to the anomalous pattern, diagnoses and corrects, or informs a human operator regarding the monitored devices, systems, or network.
In a preferred embodiment, the monitoring data includes a set of data streams each possibly having a different format, and each selectively interpreted so as to present information to the status monitor in a format usable by the status monitor. New data streams and formats can be dynamically added or altered. Appropriate responses can include informing human beings; taking remedial action for the monitored devices, systems, or networks; or altering or terminating the operation of the monitored devices, systems, or networks.